AzerbaijanLaw on Personal Data, cross-border transfer
Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 14
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of a person in Azerbaijan to a recipient outside Azerbaijan must ensure the destination provides legal protection at the level Azerbaijani law sets, unless the data subject has consented or the transfer is necessary to protect the subject's life or health, since Azerbaijan has no contract, binding-corporate-rule, or authority-permit route for a non-adequate destination.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which legislation of the Republic of Azerbaijan determines the "level" of legal protection that Article 14.2.2 requires of a destination country, and which authority decides whether a given country's law reaches it?
What it makes you log
Logging duty
Article 14 restricts cross-border transfer and makes the owner or operator responsible for the security of data in transfer (Article 14.4). It states no duty to keep a log or record of transfers. The control-audit journal duty is in Article 9.12, which this row does not cite.
- Kind
- None
- As of
What this law does
Transfer is the default rule under Art. 14.1, prohibited only where it threatens national security (Art. 14.2.1) or the destination country's law does not ensure legal protection at the level determined by the legislation of the Republic of Azerbaijan (Art. 14.2.2).
Art. 14.3 then creates a broad override: with the data subject's consent, or where necessary to protect the subject's life or health, transfer may proceed regardless of the destination's actual level of legal protection, meaning consent fully overrides the adequacy-style standard rather than merely supplementing it.
No standard-contract, binding-corporate-rule, or authority-permit mechanism exists for a non-adequate destination, unlike several regional peers' authority-approval or contract-approval routes; this is a noticeably thinner, more binary regime, which is why the jurisdiction reads as strict rather than moderate. No data localization is compelled.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .